Re: [Dots] Éric Vyncke's No Objection on draft-ietf-dots-architecture-16: (with COMMENT)

[tirumal reddy <[e-mail]>]

Hi Eric,

Thanks for the review. Please see inline

On Mon, 3 Feb 2020 at 15:48, Éric Vyncke via Datatracker <[e-mail]>
wrote:

> Éric Vyncke has entered the following ballot position for
> draft-ietf-dots-architecture-16: No Objection
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-dots-architecture/
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> Dear authors,
>
> Thank you for the work put into this document. As a side note, I really
> liked
> the section about the manual/over-the-phone part of it.
>
> Until now, I have read only this document (dots-architecture) from the
> dots WG,
> so, please accept my ignorance for details. But, I have a couple of
> non-blocking questions where your reply will be welcome and appreciated:
>
> Q1) is the monetary cost part of the DOTS signaling ? (I.e., the mitigator
> telling the target that it will cost so many EUR per hour)
>

No, monetary cost is not part of the DOTS signaling.


>
> Q2) Using DOTS in an under-attack network, did you consider recommending
> dual-stack signaling to cope with the rare case where IPv4 is disrupted
> while
> IPv6 still works (of course if the DoS is plain flooding this won't help a
> lot
> probably; and the dual proposition exists).
>

Yes, Happy Eyeballs for DOTS signal channel is discussed in
https://tools.ietf.org/html/draft-ietf-dots-signal-channel-41#section-4.3


>
> Q3) While I appreciate the value of Anycast DOTS server, hence UDP is
> mostly
> required for signaling transport, I wonder whether the choice of UDP (often
> used AFAIK as volumetric attack as it is easier to spoof) is a good choice
> compared to TCP or DSCP or ...
>

Both DTLS over UDP and TLS over TCP is used by the DOTS signal channel (UDP
is given higher precedence than TCP).
DTLS is capable of defending against DoS attack by using the stateless
cookie mechanism (see https://tools.ietf.org/html/rfc6347#section-4.2.1)


>
> Q4) When having multiple DOTS servers, I assume that the case of a
> dual-stack
> DOTS server is also covered. Therefore, a word on whether Happy Eyeball
> (RFC
> 8305) should probably be useful **IF** applicable
>

Happy Eyeball is discussed in detail in the DOTS signal channel protocol
specification.

Cheers,
-Tiru


>
> Regards
>
> -éric
>
> Regards,
>
> -éric
>
>
>